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DETAILED ACTION 

1. This action is in response to the amendment filed on 11/10/2006. 

2. Claims 2, 13 and 18 are canceled. Claims 1, 12, 16-17, 19 and 15 are amended. 
Claims 1, 3-12, 14-17 and 19-27 are pending in this application. 

Response to Arguments 

3. Applicant's arguments with respect to claims 1-27 have been considered but are 
moot in view of the new ground(s) of rejection. 

4. In response to applicant's argument that the references fail to show certain 
features of applicant’s invention, it is noted that the features upon which applicant relies 
(i.e., a pseudo-random security string being displayed to the first user) are not recited in 
the rejected claim(s). Although the claims are interpreted in light of the specification, 
limitations from the specification are not read into the claims. See In re Van Geuns, 988 
F.2d 1181,26 USPQ2d 1057 (Fed. Cir. 1993). 

Claim Objections 

5. Claims 9, 11 and 15 objected to because of the following informalities: claim 2, 

13 and 18 are canceled, claims 9,11 and 15 need to change their dependency. 
Appropriate correction is required. 


Claim Rejections - 35 USC § 103 
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6. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

7. Claims 1, 9-10,12, 15-17 and 25-26 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over Marvit et al. (US Patent 6625734) (hereinafter Marvit) in view 
of Patterson (US Patent 6389541) (hereinafter Patterson), and further in view of Covert 
(US 5177789) (hereinafter Covert). 

Regarding to claim 1, Marvit teaches a method of transferring a data file having 
a file name from a first computer operated by a first user to a second computer operated 
by a second user, under control of a third computer, comprising the steps of: 

i) in the first computer, the first user selecting a data file for transfer and 
establishing a communications link with the third computer (Marvit: see figure 1, column 
4 lines 10-26); 

ii) verifying an identity of the first user to the third computer by way of verification 
communications between the first and third computers (Marvit: see figure 1, column 5 
lines 16-35); 

iv) transmitting the file name of the data file from the first computer to the third 
computer, together with first user identification information and the unique key code 
(Marvit: column 4 lines 38-47 and column 5 lines 35-42); 
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vi) verifying an identity of the second user to the third computer by way of 
verification communications between the second and third computers (Marvit: see figure 
1, column 5 lines 22-35); 

vii) upon successful verification of the identity of the second user, transmitting 
the file name of the data file from the second computer to the third computer with a 
request for the unique key code (Marvit: see figure 1, column 5 lines 57-67 and column 
6 lines 1-4); and 

iii) Marvit teaches in the first computer encrypting the data file and transmitting 
the encrypted data file directly to the second computer with user identification 
information and the file name of the data file (Marvit: see figure 1, column 5 lines 22-27 
and lines 35-56); 

v) Marvit teaches in the second computer, upon receipt of the wrapped or 
encrypted data file and upon attempted access thereto by the second user, establishing 
a communications link with the third computer (Marvit: see figure 1, column 5 lines 22- 
35 and lines 57-67 and column 6 lines 1-4); 

viii) Marvit teaches transmitting the unique key code from the third computer to 
the second computer to unwrap or decrypt the data file and to allow access thereto in 
the second computer by the second user (Marvit: column 5 lines 57-67 and column 6 
lines 1-4). 

Marvit does not explicitly disclose the unique key code causes the executable file 
to unwrap or decrypt the data file. However, Patterson teaches the unique key code 
causes the executable file to unwrap or decrypt the data file (Patterson: column 8 lines 
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7-19 and lines 49-67 and column 9 lines 1-8). At the time of the invention, it would have 
been obvious to a person of ordinary skill in the art to incorporate the teaching of 
Patterson as stated above with the secure file transfer method and system of Marvit for 
wrapping the data file within the executable file because multimedia files may require 
significant time to download from the server on which they reside, due to the large size 
of the files and limited bandwidth of the network over which they must be sent. Thus, 
browsing the Web in real-time for viewing of digital content such as newspapers and 
movies may not be desirable or practical for many users. An alternative method is to 
package the content in a compressed, encrypted, self-extracting format and deliver it to 
the user's computer, and after the user has paid for the object, to allow access to the 
content at the user's computer (Patterson: column 8 lines 7-19). 

Marvit in view of Patterson does not explicitly disclose wherein the identity of the 
first user is verified by the way of: a pseudo-random security string being displayed to 
the first user; the first user applying a first user mask code to the pseudo-random 
security string in the first computer so as to generate a first user volatile identification 
code, and the first user transmitting the first user volatile identification code to the third 
computer and the third computer comparing the first user volatile identification code with 
a first check volatile identification code obtained by applying the first user mask code to 
the pseudo-random string in the third computer, identity verification taking place when 
identification code and the first check volatile identification codes are found to match 
each other. Covert teaches that limitation (Covert: see figures [5, 6] and column 5 lines 
15-46). Therefore, it would have been obvious to one of ordinary skill in the art at the 
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time the invention to apply the teaching of Covert to the system of Marvit in view of 
Patterson because it would provide the benefit of using a computer security device and 
method in which both an encrypted password and an encrypted time-related code are 
required for access to a computer system, wherein the information is generated 
employing a small, easily carried, simple and inexpensive device (Covert: column 2 
lines 10-14). 

Regarding to claim 9, Marvit in view of Patterson does not explicitly disclose: 

i) the pseudo-random string comprises a first linear array of characters, each 
character having a given numerical position in the first array (first, second, third etc.); 

ii) the mask code comprises a second linear array of numbers, each number 
having a given numerical position in the second array (first, second, third etc.); and 

iii) the volatile identification code is generated by applying the mask code to the 
pseudo-random string so as sequentially to select numerical positions in the first array 
on the basis of the numbers in the second array, taken in positional order, and to return 
the characters thereby selected from the first array in sequence so as to form a third 
linear array, this third linear array forming the volatile identification code. 

However, Covert teaches that limitation (Covert: see figures [5, 6] and column 5 
lines 15-46). Therefore, it would have been obvious to one of ordinary skill in the art at 
the time the invention to apply the teaching of Covert to the system of Marvit in view of 
Patterson because it would provide the benefit of using a computer security device and 
method in which both an encrypted password and an encrypted time-related code are 
required for access to a computer system, wherein the information is generated 
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employing a small, easily carried, simple and inexpensive device (Covert: column 2 
lines 10-14). 

Regarding to claim 15, the rejection of claim 13 is incorporated and further this 
claim has limitation that is similar to those of claim 9, thus it is rejected with the same 
rationale applied against claim 9 above. 

Regarding to claim 25, the rejection of claim 18 is incorporated and further this 
claim has limitation that is similar to those of claim 9, thus it is rejected with the same 
rationale applied against claim 9 above. 

Regarding to claim 10, Marvit further teaches wherein the third computer 
maintains a record of transactions between the first, second and third computers so as 
to permit an audit trail to be established (Marvit: column 3 lines 11-56). 

Regarding to claim 12, this claim has limitations that is similar to those of claim 
1, thus it is rejected with the same rationale applied against claim 1 above. 

Regarding to claim 16, this claim has limitations that is similar to those of claim 
1, thus it is rejected with the same rationale applied against claim 1 above. 

Regarding to claim 17, this claim has limitations that is similar to those of claim 
1, thus it is rejected with the same rationale applied against claim 1 above. 

Regarding to claim 26, the rejection of claim 17 is incorporated and further this 
claim has limitation that is similar to those of claim 10, thus it is rejected with the same 
rationale applied against claim 10 above. 
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8. Claims 3-7, 11, 19-23 and 27 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Marvit in view of Patterson in view of Covert, and further in view of 
Goldfine et al (US Patent 5343529) (hereinafter Goldfine). 

Regarding to claim 3, Marvit in view of Patterson in view of Covert does not 
explicitly teach wherein the identity of the second user is verified in step vi) above by 
way of the second user applying a second user mask code to a first pseudo-random 
security string in the second computer so as to generate a second user volatile 
identification code, the second user transmitting the second user volatile identification 
code to the third computer and the third computer comparing the second user volatile 
identification code with a second check volatile identification code obtained by applying 
the second user mask code to a second pseudo-random string in the third computer, 
identity verification taking place when the second user volatile identification code and 
the second check volatile identification codes are found to match each other. 

However, Goldfine teaches wherein the identity of the second user is verified in 
step vi) above by way of the second user applying a second user mask code to a first 
pseudo random security string in the second computer so as to generate a second user 
volatile identification code, the second user transmitting the second user volatile 
identification code to the third computer and the third computer comparing the second 
user volatile identification code with a second check volatile identification code obtained 
by applying the second user mask code to a second pseudo-random string in the third 
computer, identity verification taking place when the second user volatile identification 
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code and the second check volatile identification codes are found to match each other 
(Goldfine: column 4 lines 25-53). 

At the time of the invention, it would have been obvious to a person of ordinary 
skill in the art to incorporate the teaching of Goldfine as stated above with the secure file 
transfer method and system and the method of regulating access to digital content of 
Marvit in view Patterson in view of Covert for verifying user’s identity by applying a mask 
code to a pseudo-random security string to generate a volatile identification code 
because hackers seeking access to telecommunication and computer networks 
program their computers to try thousands of access codes in an attempt to find one that 
works. Once a successful code is found, the hacker can gain network access. Similar 
problems will exist for emerging interactive television services, such as entertainment 
and home shopping. Authentication techniques that use repeatedly transmitted access 
codes are susceptible to various sophisticated attacks. Some technique is needed to 
keep the attackers off balance (Goldfine: column 1 lines 64-67 and column 2 lines 1-5). 

Regarding to claim 4, Marvit in view of Patterson in view of Covert does not 
explicitly disclose wherein the first pseudo-random security string and the second 
pseudo-random security string are the same. 

However, Goldfine teaches wherein the first pseudo-random security string and 
the second pseudo-random security string are the same (Goldfine: see figure 2, column 
6 lines 29-55). 

At the time of the invention, it would have been obvious to a person of ordinary 
skill in the art to incorporate the teaching of Goldfine as stated above with the secure file 
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transfer method and system and the method of regulating access to digital content of 
Marvit in view Patterson in view of Covert for verifying user’s identity wherein the first 
pseudo-random security string and the second pseudo-random security string are the 
same because using the first and second string to produce an authentication code 
which authenticates a transaction request in order to permit progress of a transaction 
based on a match (Goldfine: column 1 lines 9-11). 

Regarding to claim 5, Marvit in view of Patterson in view of Covert does not 
explicitly disclose wherein the pseudo-random string is generated by the third computer 
and transmitted firstly to the first computer and then from the first computer to the 
second computer. 

However, Goldfine teaches wherein the pseudo-random string is generated by 
the third computer and transmitted firstly to the first computer and then from the first 
computer to the second computer (Goldfine: see figure 2, column 4 lines 25-53). 

At the time of the invention, it would have been obvious to a person of ordinary 
skill in the art to incorporate the teaching of Goldfine as stated above with the secure file 
transfer method and system and the method of regulating access to digital content of 
Marvit in view Patterson in view of Covert for verifying user’s identity by sending the 
pseudo-random string from the third computer to the first and from first to the second 
because hackers seeking access to telecommunication and computer networks 
program their computers to try thousands of access codes in an attempt to find one that 
works. Once a successful code is found, the hacker can gain network access. Similar 
problems will exist for emerging interactive television services, such as entertainment 
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and home shopping. Authentication techniques that use repeatedly transmitted access 
codes are susceptible to various sophisticated attacks. Some technique is needed to 
keep the attackers off balance (Goldfine: column 1 lines 64-67 and column 2 lines 1-5). 

Regarding to claim 6, Marvit in view of Patterson in view of Covert does not 
explicitly disclose wherein the pseudo-random string is generated by the third computer 
and transmitted firstly to the first computer and then from the third computer to the 
second computer. 

However, Goldfine teaches wherein the pseudo-random string is generated by 
the third computer and transmitted firstly to the first computer and then from the third 
computer to the second computer (Goldfine: see figure 2, column 6 lines 29-68 and 
column 7 lines 1-23). 

At the time of the invention, it would have been obvious to a person of ordinary 
skill in the art to incorporate the teaching of Goldfine as stated above with the secure file 
transfer method and system and the method of regulating access to digital content of 
Marvit in view Patterson in view of Covert for verifying user’s identity wherein the 
pseudo-random string is generated by the third computer and transmitted firstly to the 
first computer and then from the third computer to the second computer because 
hackers seeking access to telecommunication and computer networks program their 
computers to try thousands of access codes in an attempt to find one that works. Once 
a successful code is found, the hacker can gain network access. Similar problems will 
exist for emerging interactive television services, such as entertainment and home 
shopping. Authentication techniques that use repeatedly transmitted access codes are 
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susceptible to various sophisticated attacks. Some technique is needed to keep the 
attackers off balance (Goldfine: column 1 lines 64-67 and column 2 lines 1-5). 

Regarding to claim 7, Marvit in view Patterson in view of Covert does not 
explicitly disclose wherein the first pseudo-random security string and the second 
pseudo-random security string are different. 

However, Goldfine teaches wherein the first pseudo-random security string and 
the second pseudo-random security string are different (Goldfine: column 6 lines 29-68 
and column 7 lines 1-23). 

At the time of the invention, it would have been obvious to a person of ordinary 
skill in the art to incorporate the teaching of Goldfine as stated above with the secure file 
transfer method and system and the method of regulating access to digital content of 
Marvit in view Patterson in view of Covert for verifying user’s identity wherein the first 
pseudo-random security string and the second pseudo-random security string are 
different because hackers seeking access to telecommunication and computer networks 
program their computers to try thousands of access codes in an attempt to find one that 
works. Once a successful code is found, the hacker can gain network access. Similar 
problems will exist for emerging interactive television services, such as entertainment 
and home shopping. Authentication techniques that use repeatedly transmitted access 
codes are susceptible to various sophisticated attacks. Some technique is needed to 
keep the attackers off balance (Goldfine: column 1 lines 64-67 and column 2 lines 1-5). 

Regarding to claim 11, Marvit in view of Patterson in view of Covert teaches 
wherein the first and/or second user volatile identification codes are stored as digital 
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signatures in the third computer in combination with the associated pseudo-random 
security string (Marvit: column 17 lines 42-59). 

Regarding to claim 19, the rejection of claim 18 is incorporated and further this 
claim has limitation that is similar to those of claim 3, thus it is rejected with the same 
rationale applied against claim 3 above. 

Regarding to claim 20, the rejection of claim 19 is incorporated and further this 
claim has limitation that is similar to those of claim 4, thus it is rejected with the same 
rationale applied against claim 4 above. 

Regarding to claim 21, the rejection of claim 20 is incorporated and further this 
claim has limitation that is similar to those of claim 5, thus it is rejected with the same 
rationale applied against claim 5 above. 

Regarding to claim 22, the rejection of claim 20 is incorporated and further this 
claim has limitation that is similar to those of claim 6, thus it is rejected with the same 
rationale applied against claim 6 above. 

Regarding to claim 23, the rejection of claim 19 is incorporated and further this 
claim has limitation that is similar to those of claim 7, thus it is rejected with the same 
rationale applied against claim 7 above. 

Regarding to claim 27, the rejection of claim 18 is incorporated and further this 
claim has limitation that is similar to those of claim 11, thus it is rejected with the same 
rationale applied against claim 11 above. 
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9. Claims 8,14 and 24 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Marvit in view of Patterson in view Covert, and further in view of Wilfong U.S. 

Patent 5754652 (hereinafter Wilfong). 

Regarding to claim 8, Marvit in view of Patterson in view of Covert does not 
explicitly disclose: 

i) said secure user code entry interface contains at least one active display for 
entry of at least one digit of said user mask code by the user; wherein said active 
display illuminates or highlights at least one display digit within said active display and 
said user enters said at least one digit of said user mask code by a response through an 
input device at a response time when said at least one display digit which corresponds 
with said at least one digit of said user mask code is illuminated or highlighted in said 
active display; and 

ii) a random run on time is added to said response time to extend said at least 
one active display. 

However, Wilfong teaches i) said secure user code entry interface contains at 
least one active display for entry of at least one digit of said user mask code by the 
user; wherein said active display illuminates or highlights at least one display digit within 
said active display and said user enters said at least one digit of said user mask code 
by a response through an input device at a response time when said at least one 
display digit which corresponds with said at least one digit of said user mask code is 
illuminated or highlighted in said active display (Wilfong: column 2 lines 28-41); and ii) a 
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random run on time is added to said response time to extend said at least one active 
display (Wilfong: column 2 lines 28-41). 

At the time of the invention, it would have been obvious to a person of ordinary 
skill in the art to incorporate the teaching of Wilfong as stated above with the secure file 
transfer method and system and the method of regulating access to digital content of 
Marvit in view Patterson in view of Covert for verifying user’s identity by using an active 
display to capture the PIN number of user at a response time because the system 
prompts are made in such a way as not to be observable by bystanders (Wilfong: 
column 2 lines 32-34). 

Regarding to claim 14, the rejection of claim 12 is incorporated and further this 
claim has limitations that is similar to those of claim 8, thus it is rejected with the same 
rationale applied against claim 8 above. 

Regarding to claim 24, the rejection of claim 17 is incorporated and further this 
claim has limitations that is similar to those of claim 8, thus it is rejected with the same 
rationale applied against claim 8 above. 

Conclusion 

10. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
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mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 
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Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Trang Doan whose telephone number is (571) 272- 
0740. The examiner can normally be reached on Monday-Friday. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner’s 
supervisor, Ayaz Sheikh can be reached on (571) 272-3795. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 

Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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Examiner 
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